So if this security mirror already has the updated package
mirrored, it's fetched from there as it's the first hit for the newest
version. If not, the newest package is still already available and
fetched from the official servers.